# How do drop logs from being forwarded? My drop rule doesn't seem to be working **URL:** \ **Category:** Logstash\ **Created:** [August 23, 2023, 9:38pm UTC](https://discuss.elastic.co/t/how-do-drop-logs-from-being-forwarded-my-drop-rule-doesnt-seem-to-be-working/341520 "2023-08-23T21:38:18Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![feo13](https://avatars.discourse-cdn.com/v4/letter/f/bc8723/32.png) [@feo13](https://discuss.elastic.co/u/feo13)\ **Post date:** [August 23, 2023, 9:38pm UTC](https://discuss.elastic.co/t/how-do-drop-logs-from-being-forwarded-my-drop-rule-doesnt-seem-to-be-working/341520/1 "2023-08-23T21:38:18Z")
I'm ingesting AWS WAF logs and would like to drop the 'ALLOW' logs. I have the following filter in place but it doesn't seem to be working: ```auto filter { if "\"action\":\"ALLOW\"" in [message] { drop {} } if [type] == "waf-log" { json { source => "message" } date { match => ["[timestamp]", "UNIX_MS" ] } geoip { source => ["[httpRequest][clientIp]" ] target => geoip } } } ``` The logs are ugly but near the top of this mess is what I'm trying to match on ("action":"ALLOW") : ` {"timestamp":1691284267528,"formatVersion":1,"webaclId":"arn:aws:wafv2:us-east-1:13:regional/webacl/testhaproxy-pub/348b1a33-94f8-4090-98c3-2d58fb0802f2","terminatingRuleId":"Default_Action","terminatingRuleType":"REGULAR","action":"ALLOW","terminatingRuleMatchDetails":[],"httpSourceName":"ALB","httpSourceId":"13-app/test/7646e40a4e7f47c8","ruleGroupList":[{"ruleGroupId":"arn:aws:wafv2:us-east-1:13:regional/rulegroup/Community_sourced_IP_block_list/cfa0b98a-c8f9-4832-9e46-33e3363d4902","terminatingRule":null,"nonTerminatingMatchingRules":[],"excludedRules":null,"customerConfig":null},{"ruleGroupId":"AWS#AWSManagedRulesKnownBadInputsRuleSet","terminatingRule":null,"nonTerminatingMatchingRules":[],"excludedRules":null,"customerConfig":null}],"rateBasedRuleList":[],"nonTerminatingMatchingRules":[],"requestHeadersInserted":null,"responseCodeSent":null,"httpRequest":{"clientIp":"8.8.8.8","country":"US","headers":[{"name":"Host","value":"test.example.com"},{"name":"User-Agent","value":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36"},{"name":"X-Amz-Cf-Id","value":"UhoYRGs6vYv9voCY1PMYwRnyT9K-PddELJnhH2AwS9Hzm1AHwTcJJg=="},{"name":"Connection","value":"Keep-Alive"},{"name":"Content-Length","value":"1420"},{"name":"Via","value":"2.0 cf067f00f2e5b21f25d2ffca9aa60006.cloudfront.net (CloudFront)"},{"name":"X-Forwarded-For","value":"4.4.4.4"},{"name":"Accept-Language","value":"en-US,en;q=0.9"},{"name":"Accept","value":"text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7"},{"name":"Referer","value":"https://test.example.com/s3/2/3"},{"name":"Accept-Encoding","value":"gzip, deflate, br"},{"name":"cache-control","value":"max-age=0"},{"name":"sec-ch-ua","value":"\"Not/A)Brand\";v=\"99\", \"Google Chrome\";v=\"115\", \"Chromium\";v=\"115\""},{"name":"sec-ch-ua-mobile","value":"?0"},{"name":"sec-ch-ua-platform","value":"\"Windows\""},{"name":"upgrade-insecure-requests","value":"1"},{"name":"origin","value":"https://test.example.com"},{"name":"content-type","value":"multipart/form-data; boundary=----WebKitFormBoundaryfcoYCAy2fmiB4igH"},{"name":"sec-fetch-site","value":"same-origin"},{"name":"sec-fetch-mode","value":"navigate"},{"name":"sec-fetch-user","value":"?1"},{"name":"sec-fetch-dest","value":"document"},{"name":"CloudFront-Is-Mobile-Viewer","value":"false"},{"name":"CloudFront-Is-Tablet-Viewer","value":"false"},{"name":"CloudFront-Is-SmartTV-Viewer","value":"false"},{"name":"CloudFront-Is-Desktop-Viewer","value":"true"},{"name":"CloudFront-Viewer-Country","value":"US"},{"name":"CloudFront-Forwarded-Proto","value":"https"},{"name":"CloudFront-Viewer-ASN","value":"22773"}],"uri":"/s3/2/3","args":"","httpVersion":"HTTP/1.1","httpMethod":"POST","requestId":"1-64cef32b-644627a2000354c90c5e7329"},"requestBodySize":1420,"requestBodySizeInspectedByWAF":1420}` How does that need to get set up so it drops these logs properly? A side question -- is there a way I can delete the existing `"action":"ALLOW"` logs from all indicies? Thank you! ---
**Author:** ![Ljapunov](https://avatars.discourse-cdn.com/v4/letter/l/f4b2a3/32.png) [@Ljapunov](https://discuss.elastic.co/u/Ljapunov)\ **Post date:** [August 24, 2023, 12:08pm UTC](https://discuss.elastic.co/t/how-do-drop-logs-from-being-forwarded-my-drop-rule-doesnt-seem-to-be-working/341520/2 "2023-08-24T12:08:40Z")
Hi, actually I do not think that what you search is in the `[message]` field. Try this one: ```auto if [action] == "ALLOW" { drop {} } ``` And to your side question: Yes you can use [\_delete\_by\_query](https://www.elastic.co/guide/en/elasticsearch/reference/current/docs-delete-by-query.html) API. ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [August 24, 2023, 2:13pm UTC](https://discuss.elastic.co/t/how-do-drop-logs-from-being-forwarded-my-drop-rule-doesnt-seem-to-be-working/341520/3 "2023-08-24T14:13:46Z")
Doing the drop after parsing the JSON results in a lot of wasted work. It would be more efficient to match the [message] field than the [action] field. And if these are firewall logs I would expect the majority of events to have ALLOW, so it is a big optimisation. ---
**Author:** ![feo13](https://avatars.discourse-cdn.com/v4/letter/f/bc8723/32.png) [@feo13](https://discuss.elastic.co/u/feo13)\ **Post date:** [August 24, 2023, 6:28pm UTC](https://discuss.elastic.co/t/how-do-drop-logs-from-being-forwarded-my-drop-rule-doesnt-seem-to-be-working/341520/4 "2023-08-24T18:28:33Z")
Thank you both for the replies. I tried changing it to 'if [action] == "ALLOW"', but I'm still seeing allow logs coming in. Here's the updated filter: ```auto filter { if [action] == "ALLOW" { drop {} } if [type] == "waf-log" { json { source => "message" } date { match => ["[timestamp]", "UNIX_MS" ] } geoip { source => ["[httpRequest][clientIp]" ] target => geoip } } } ``` But I expand one of the logs, I do see that field so I'm not sure what's going on. ![image](https://us1.discourse-cdn.com/elastic/original/3X/5/3/5340dd2da8434b32b0c878fe4df9290d726e195e.png) And @Badger, you're right -- ~97% of the logs are allows so getting this right will make a huge impact. Thanks again! ---
**Author:** ![Badger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/badger/32/25190_2.png) [@Badger](https://discuss.elastic.co/u/Badger)\ **Post date:** [August 24, 2023, 6:48pm UTC](https://discuss.elastic.co/t/how-do-drop-logs-from-being-forwarded-my-drop-rule-doesnt-seem-to-be-working/341520/5 "2023-08-24T18:48:44Z")
> [@feo13](#): > > `if "\"action\":\"ALLOW\""` Are you sure all the whitespace is stripped from this type of log? Looking at AWF example logs some do, some do not. You could try `'"action":\s*"ALLOW"'`. ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [September 21, 2023, 6:49pm UTC](https://discuss.elastic.co/t/how-do-drop-logs-from-being-forwarded-my-drop-rule-doesnt-seem-to-be-working/341520/6 "2023-09-21T18:49:14Z")
Closed on September 21, 2023, 6:49pm UTC This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.